An enterprise runs a data-processing pipeline on Amazon EC2 instances located in private s… — AWS Certified Solutions Architect - Associate

An enterprise runs a data-processing pipeline on Amazon EC2 instances located in private subnets across three Availability Zones in a VPC. The instances upload approximately $80\text{ TB}$ of raw data monthly to an Amazon S3 bucket in the same AWS Region. In addition, the pipeline replicates $15\text{ TB}$ of processed data monthly to another VPC within the same Region for analytics, and retrieves $5\text{ TB}$ of metadata monthly from an on-premises database via a backup AWS Site-to-Site VPN connection. The VPC also has an active $1\text{ Gbps}$ AWS Direct Connect connection currently used only for administrative traffic. The S3 traffic currently routes through NAT Gateways, and inter-VPC replication goes through an AWS Transit Gateway. Which combination of actions will reduce data transfer and processing costs the most?

Create a gateway VPC endpoint for Amazon S3 in the VPC. Establish a VPC peering connection between the two VPCs and update the route tables to route the replication traffic directly. Update the routing configuration to send the on-premises metadata traffic over the AWS Direct Connect connection instead of the Site-to-Site VPN.Answer
B
Keep routing the Amazon S3 traffic through the NAT Gateways to maintain security group controls, replace the Transit Gateway with a VPC peering connection for inter-VPC replication, and route the on-premises metadata traffic over the Site-to-Site VPN.
C
Create a gateway VPC endpoint for Amazon S3. Establish a VPC peering connection for inter-VPC replication. Route all on-premises metadata traffic over a single AWS Site-to-Site VPN tunnel, expecting the tunnel to scale past its $1.25\text{ Gbps}$ throughput limit to handle peak database queries.
D
Create an interface VPC endpoint (AWS PrivateLink) for Amazon S3 to secure the bucket traffic. Establish a VPC peering connection between the VPCs for the replication traffic, and continue routing the on-premises metadata traffic over the existing Site-to-Site VPN connection.

Answer

Create a gateway VPC endpoint for Amazon S3, establish a VPC peering connection for inter-VPC replication, and route the on-premises metadata traffic over the existing AWS Direct Connect connection.

The correct solution optimizes all three network paths for cost. First, routing the S3 uploads through a Gateway VPC Endpoint removes the high processing fees associated with NAT Gateways. Second, establishing VPC Peering instead of using Transit Gateway removes the processing fees per GB of data transferred between VPCs. Third, migrating the on-premises database traffic from the Site-to-Site VPN to the existing Direct Connect connection takes advantage of lower data transfer out fees on Direct Connect.

Step-by-Step Solution

Analyze the S3 data transfer cost path.

Transitioning the 80 TB/month S3 upload from NAT Gateways to a Gateway VPC Endpoint removes the

0.045/GB NAT Gateway processing fee, reducing costs by

3,600/month.

Gateway VPC Endpoints for S3 are free and do not incur processing or hourly fees.

Analyze inter-VPC replication cost path.

Transitioning the 15 TB/month inter-VPC replication from AWS Transit Gateway to a VPC Peering connection removes the Transit Gateway processing fee of

0.02/GB, saving

300/month.

VPC Peering does not charge processing fees, unlike AWS Transit Gateway which charges per GB processed.

Analyze on-premises metadata retrieval cost path.

Routing the 5 TB/month metadata transfer over the existing AWS Direct Connect connection instead of the Site-to-Site VPN (which routes over the public internet) utilizes cheaper Direct Connect data transfer out pricing.

AWS Direct Connect data transfer out fees are lower than standard Internet/VPN egress fees, and utilizing the existing connection maximizes its value.

Key Concept

Data Transfer and Network Routing Cost Optimization

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics